Skip to content
This repository was archived by the owner on Jun 11, 2025. It is now read-only.

Improve/websock and cr#299

Merged
abdheshnayak merged 2 commits into
mainfrom
improve/websock-and-cr
Mar 14, 2024
Merged

Improve/websock and cr#299
abdheshnayak merged 2 commits into
mainfrom
improve/websock-and-cr

Conversation

@abdheshnayak
Copy link
Copy Markdown
Contributor

@abdheshnayak abdheshnayak commented Mar 14, 2024

  • updated token generation logic for the grpc of container registry for internal use
  • added record version to websocket logs.

Copy link
Copy Markdown

@sourcery-ai sourcery-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @abdheshnayak - I've reviewed your changes and found some issues that need to be addressed.

General suggestions:

  • Ensure that all new methods and changes adhere to existing security protocols, especially regarding the handling of secrets and tokens.
  • Review the logging level changes to ensure they align with the intended severity and information disclosure policies.
  • Consider the impact of the new admin credential creation method on existing workflows and ensure it integrates smoothly with the current system architecture.
Here's what I looked at during the review
  • 🟢 General issues: all looks good
  • 🔴 Security: 1 blocking issue
  • 🟢 Testing: all looks good
  • 🟢 Complexity: all looks good
  • 🟢 Docstrings: all looks good

Thanks for using Sourcery. We offer it for free for open source projects and would be very grateful if you could help us grow. If you like it, would you consider sharing Sourcery on your favourite social media? ✨

Share Sourcery

Help me be more useful! Please click 👍 or 👎 on each comment to tell me if it was helpful.

if err != nil {
return nil, errors.NewE(err)
}
token, err := admin.GenerateToken(KL_ADMIN, credential.AccountName, string(credential.Access), i, d.envs.RegistrySecretKey+credential.AccountName)
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 issue (security): Hard-coded secret detected in the concatenation of d.envs.RegistrySecretKey with credential.AccountName. This approach can potentially expose sensitive information. Consider securely managing secrets, for example, through a secrets manager.

@abdheshnayak abdheshnayak merged commit 343b03b into main Mar 14, 2024
@abdheshnayak abdheshnayak deleted the improve/websock-and-cr branch March 14, 2024 12:35
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant